/**
 * 简化版Hook测试 - 快速验证
 */

console.log("\n" + "=".repeat(80));
console.log("🎯 开始Hook麦当劳APP");
console.log("=".repeat(80) + "\n");

// 立即执行
console.log("📱 已连接到进程");

// Hook AES密钥
setTimeout(function() {
    console.log("🔍 开始设置Hook...\n");
    
    // 1. Hook AES_set_encrypt_key
    try {
        var aes_set_key = Module.findExportByName(null, "AES_set_encrypt_key");
        if (aes_set_key) {
            console.log("✅ 找到 AES_set_encrypt_key @ " + aes_set_key);
            
            Interceptor.attach(aes_set_key, {
                onEnter: function(args) {
                    var key = args[0];
                    var bits = args[1].toInt32();
                    var bytes = bits / 8;
                    
                    console.log("\n" + "🔑".repeat(40));
                    console.log("🔑 捕获到AES密钥设置！");
                    console.log("=".repeat(80));
                    console.log("密钥长度: " + bits + " bits (" + bytes + " bytes)");
                    
                    if (key && bytes > 0 && bytes <= 32) {
                        try {
                            var buf = ptr(key).readByteArray(bytes);
                            var arr = new Uint8Array(buf);
                            var hex = "";
                            for (var i = 0; i < arr.length; i++) {
                                hex += ("0" + arr[i].toString(16)).slice(-2);
                            }
                            
                            console.log("\n🔐 密钥 HEX:");
                            console.log(hex);
                            console.log("\n📋 Hexdump:");
                            console.log(hexdump(key, {length: bytes, header: false}));
                            console.log("=".repeat(80));
                            console.log("🔑".repeat(40) + "\n");
                            
                        } catch(e) {
                            console.log("读取失败: " + e);
                        }
                    }
                }
            });
        } else {
            console.log("❌ 未找到 AES_set_encrypt_key");
        }
    } catch(e) {
        console.log("❌ Hook失败: " + e);
    }
    
    // 2. Hook EVP_EncryptInit_ex
    try {
        var evp_init = Module.findExportByName(null, "EVP_EncryptInit_ex");
        if (evp_init) {
            console.log("✅ 找到 EVP_EncryptInit_ex @ " + evp_init);
            
            Interceptor.attach(evp_init, {
                onEnter: function(args) {
                    var key = args[3];
                    var iv = args[4];
                    
                    if (key && !key.isNull()) {
                        console.log("\n🔐 EVP_EncryptInit_ex 调用");
                        
                        try {
                            var keyBuf = ptr(key).readByteArray(32);
                            var keyArr = new Uint8Array(keyBuf);
                            var keyHex = "";
                            for (var i = 0; i < keyArr.length; i++) {
                                keyHex += ("0" + keyArr[i].toString(16)).slice(-2);
                            }
                            console.log("密钥: " + keyHex);
                        } catch(e) {}
                        
                        if (iv && !iv.isNull()) {
                            try {
                                var ivBuf = ptr(iv).readByteArray(16);
                                var ivArr = new Uint8Array(ivBuf);
                                var ivHex = "";
                                for (var i = 0; i < ivArr.length; i++) {
                                    ivHex += ("0" + ivArr[i].toString(16)).slice(-2);
                                }
                                console.log("IV: " + ivHex);
                            } catch(e) {}
                        }
                        console.log("");
                    }
                }
            });
        } else {
            console.log("❌ 未找到 EVP_EncryptInit_ex");
        }
    } catch(e) {
        console.log("❌ Hook失败: " + e);
    }
    
    // 3. 列出加载的so库
    console.log("\n📚 已加载的so库（包含加密相关）：");
    var modules = Process.enumerateModules();
    modules.forEach(function(m) {
        var name = m.name.toLowerCase();
        if (name.indexOf(".so") !== -1 && 
            (name.indexOf("crypto") !== -1 || 
             name.indexOf("ssl") !== -1 ||
             name.indexOf("sm") !== -1 ||
             name.indexOf("shumei") !== -1)) {
            console.log("  - " + m.name + " @ " + m.base);
        }
    });
    
    console.log("\n✅ Hook设置完成！等待API调用...");
    console.log("=".repeat(80) + "\n");
    
}, 1000);


